Investigative journalist Javier Valdez Cárdenas was gunned down on the streets of Culiacán, northwest Mexico, in May 2017. It was in broad daylight. Just moments beforehand, the reporter had stepped out of the newsroom of Riodoce, the Mexican weekly he cofounded to investigate drug cartels. It would be another four years until one of his killers, Juan Francisco Picos Barrueta, was sentenced to 32 years in prison for the crime.
Violence against journalists is all too common in Mexico. But this wasn’t a straightforward, brazen execution of a reporter who had dedicated his life to exposing organized crime and corruption. Two years after his death, his widow Griselda Triana, also a journalist, was informed by the Canadian digital watchdog group Citizen Lab that her mobile phone had been infected with a powerful spyware tool called Pegasus. The infection took place 10 days after her husband’s killing. Before then Triana had been completely in the dark about any state actors targeting her and Javier. ‘Although we had always heard that people could be monitored through cell phones, we did not imagine that this could happen to us,’ she said. ‘Javier tried to ensure that his conversations on his cell phone were secure.’
I asked Triana why she thought their phones had been infected. ‘So [the authorities] could obtain data from sources of information
